HIPAA Blog

[ Friday, January 18, 2008 ]

Question from the Audience: Yes, young lady, you in the back. What's your question?

I have a question. I have done a search and haven't been able to find ananswer. Perhaps I'm just not typing in the correct words!I am a nurse andI keep a public blog. In my blog, I sometimes tell stories from my shiftsin the hospital. I never identify any patient by name and often changecircumstances and gender as necessary to retain privacy for the patient. I havea friend who sent me a fiery email today, telling me that she is terrified thatI'm breaking HIPAA violations and breaching confidentiality.Many people tellstories. I'm no different. That said, it is CERTAINLY not myintention to breach anyone's private information and I typically put adisclaimer on my stories stating such. Can you tell me if I'm in the wronghere? If so, I'll delete the information immediately.Thanks for theblog... I found you on a search and learned some new things today!

Well, I'm so glad you asked that. I've blogged before about how medbloggers tread a tricky line, due to the possibility that they might disclose protected health information (PHI). If you're disclosing PHI on your blog, unless you have the consent of the patient (or you can reasonably claim the disclosure is for treatment, payment, or healthcare operations), you are causing a HIPAA violation; you probably aren't a covered entity, but your hospital is, you're their employee, and your acts count as the hospital's acts. It's probably a firing offense, too.

BUT, the question is whether you are disclosing PHI. For it to be (PHI), it has to be IIHI (individually indentifiable health information). To be IIHI, it has to either identify the individual or there must be a reasonable basis to believe the information can be used to identify the individual.

So that's the question: If I read your blog, could I figure out who you were talking about? For example, if you stated on your blog that you live in a city known for its rain, its coffee, and grunge music, and that the quarterback of the local pro football team came into the hospital recently and tested positive for HIV, that would be a disclosure of PHI even though you didn't mention Matt's name.

There's no magical formula for what or how much you can say before you reach that "reasonable basis" threshold, so the less identifying information you give the better. Further disguising the individual by fictionalizing facts and circumstances is also a good idea.